Australia’s spies are sharing intelligence with hacking targets — and want them to share back

Australia’s signals intelligence agency used declassified intelligence to warn organizations of potential cyberattacks more than 1,100 times in the year ending June, according to its annual cyber threat report published Tuesday.

More than half of the individual warnings from the Australian Signals Directorate (ASD) drew on previously secret material that had been cleared for disclosure, underscoring the growing role of intelligence sharing to prevent attacks.

The agency said it “notified entities of potential malicious cyber activity more than 4,400 times, up almost 80%, to help prevent incidents before they occurred,” including “over 2,200 individual notifications, and collective notifications issued to more than 2,100 entities.”

The numbers illustrate how the agency is turning its visibility and information advantage into warnings for those organizations that find themselves in hackers’ crosshairs, and how much it is in turn asking those organizations to report back and build collective protections.

“Reporting an incident could be the key to preventing further victims,” the report said, stressing that the agency “is not a regulator and does not share any information provided by you without your express consent.”

ASD’s tip-offs helped victims identify more than 360 incidents. One alert, sent to 340 organizations in May about flaws in the cPanel web hosting software, “resulted in more than 60 confirmed incidents.” ASD does not say how many attacks the warnings prevented, what the intelligence was, nor how many recipients acted on it.

The directorate appears to be encountering a similar challenge to its counterparts in the United Kingdom, with the report advising anyone “concerned about the legitimacy of a call” to ring the agency’s hotline and quote their reference number to confirm the warning is genuine.

Britain’s National Cyber Security Centre told Recorded Future News in 2023 that some recipients of its warnings assumed they were being scammed. In some cases the warning arrived after ransomware had already been deployed. Only about 2% of the organizations that it detected being attacked were ultimately tipped off.

Victim reporting

Reports from victims helped the ASD disrupt an Akira ransomware group campaign in August 2025, after technical evidence from several attacks pointed to a known SonicWall vulnerability.

The agency identified “almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organizations, many of them critical infrastructure entities.” It said the attacks declined after it published an alert.

“When organisations report incidents, vulnerabilities, and data such as Indicators of Compromise (IOCs) to ASD’s ACSC, they help protect not only themselves but also the entire Australian community,” it said.

In another case in August 2025, publicity about cyberattacks prompted a bank to report an attempted fraud against its help desk. Callers traced to Hong Kong were said to have twice impersonated a Melbourne employee, using the worker’s staff ID number to obtain colleagues’ names, job titles and corporate phone numbers.

The callers were “manipulative, confrontational, and aggressive,” while background voices suggested “a call centre or office environment.” The bank reported the incident after seeing media coverage of similar voice phishing attacks. The ASD did not identify the attackers.

The ASD said it saw 20% more attacks than the previous year, “likely” reflecting “improved cyber security awareness and reporting culture.” However, it still believes “most cybercrime goes unreported.”

Artificial Intelligence

AI was “the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication,” Richard Marles, Australia’s deputy prime minister and defence minister, wrote in the report’s foreword.

The report said that “in the past, defenders had months to patch, now they have days, sometimes only hours,” although it provided no data directly linking AI to faster exploitation, and acknowledged that the technology has “not introduced new cyber threats.”

Marles also wrote that “in recent weeks, new threats have emerged from the unintended actions of AI agents and model testing” without identifying specific incidents.

In September, Prime Minister Anthony Albanese said an OpenAI agent had gained unauthorized access to non-public files on a government Medicare statistics portal in June. Security researchers have questioned his description of the incident.

“The world continues to face the most complex and challenging strategic circumstances since the Second World War,” wrote Marles.

“The rules-based international order, which has underpinned Australia’s security and prosperity for decades, is in transition,” he added, with nations contesting “for influence, technological advantage and economic security. Cyber operations have become a central feature of this competition, offering adversaries a means to advance their objectives below the threshold of conventional conflict.”

Alexander Martin

is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79